[INFER] Fix merge botch, bug 673767.
authorBrian Hackett <bhackett1024@gmail.com>
Mon, 25 Jul 2011 09:33:41 -0700
changeset 76068 bdf006d7b67dad1430b7cabd384d6c956c8a3b87
parent 76067 359730f0730c1fded8e3fd657e14d41c63652525
child 76069 7e5a5d2e28f86a93c36b8473591411c212be870f
push id3
push userfelipc@gmail.com
push dateFri, 30 Sep 2011 20:09:13 +0000
bugs673767
milestone8.0a1
[INFER] Fix merge botch, bug 673767.
js/src/jit-test/tests/basic/bug673767.js
js/src/jsemit.cpp
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug673767.js
@@ -0,0 +1,2 @@
+var stack = {};
+stack.length += 3;
--- a/js/src/jsemit.cpp
+++ b/js/src/jsemit.cpp
@@ -4669,26 +4669,24 @@ EmitAssignment(JSContext *cx, JSCodeGene
                                    ? JSOP_GETARG
                                    : JSOP_GETLOCAL,
                                    atomIndex);
             }
             break;
           case TOK_DOT:
             if (js_Emit1(cx, cg, JSOP_DUP) < 0)
                 return false;
-            if (lhs->pn_atom == cx->runtime->atomState.lengthAtom) {
-                if (js_Emit1(cx, cg, JSOP_LENGTH) < 0)
-                    return false;
-            } else if (lhs->pn_atom == cx->runtime->atomState.protoAtom) {
+            if (lhs->pn_atom == cx->runtime->atomState.protoAtom) {
                 if (!EmitIndexOp(cx, JSOP_QNAMEPART, atomIndex, cg))
                     return false;
                 if (!EmitElemOpBase(cx, cg, JSOP_GETELEM))
                     return false;
             } else {
-                EMIT_INDEX_OP(JSOP_GETPROP, atomIndex);
+                bool isLength = (lhs->pn_atom == cx->runtime->atomState.lengthAtom);
+                EMIT_INDEX_OP(isLength ? JSOP_LENGTH : JSOP_GETPROP, atomIndex);
             }
             break;
           case TOK_LB:
           case TOK_LP:
 #if JS_HAS_XML_SUPPORT
           case TOK_UNARYOP:
 #endif
             if (js_Emit1(cx, cg, JSOP_DUP2) < 0)